Loading malware…
Shai-Hulud is a self-propagating software supply-chain worm and credential-stealing malware family associated with attacks on open-source package ecosystems and developer infrastructure since at least 2025. It is widely linked to TeamPCP, although some later campaigns in the broader lineage, including activity labeled Miasma or Hades, have been reported as copycats or unattributed variants rather than definitively the same operator. The malware targets developer workstations, CI/CD runners, package maintainer accounts, and cloud-connected build environments, with observed impact across ecosystems including npm and PyPI and downstream abuse of GitHub Actions, Docker Hub, OpenVSX, VS Code extensions, and internal source repositories.
Its core behavior is theft of high-value secrets from development environments, including package-registry credentials, GitHub tokens, cloud credentials, Kubernetes and Vault secrets, SSH material, browser data, cryptocurrency-wallet data, and other developer or automation secrets. Stolen access is then reused to compromise additional packages, repositories, and pipelines, allowing the malware to republish trojanized releases through victims’ legitimate publishing rights and thereby bypass protections such as two-factor authentication on maintainer accounts. Multiple reports describe worm-like propagation in which compromised maintainer or CI credentials are used to infect every package or repository the victim can modify.
Across documented waves, Shai-Hulud and closely related variants have used several execution and persistence methods. Earlier campaigns relied on malicious package publication and install-time or runtime execution in JavaScript or Python packages, while later variants shifted to more evasive mechanisms such as execution through module load paths, Python .pth auto-execution, or native-build triggers such as binding.gyp. Some variants download secondary runtimes or payload stages, establish persistence across Linux, macOS, and Windows, evade analysis through sandbox or locale checks, and support remote tasking, file operations, exfiltration, and lateral movement. Exfiltration has been observed through attacker-controlled infrastructure as well as through victim-owned GitHub repositories created or abused using stolen tokens, reducing dependence on dedicated command-and-control infrastructure.
The malware family is notable for targeting the trust relationships of modern software delivery rather than individual endpoints alone. It has been implicated in large-scale package poisoning incidents affecting hundreds of packages and exposing large volumes of secrets from CI/CD pipelines and developer environments. Reported targets and victims span software vendors, cloud-connected engineering organizations, cryptocurrency-related projects, and enterprises with modern build pipelines. Later reporting also describes destructive or coercive features in some variants, including token-revocation monitoring and fallback wiping behavior, though such functionality is not uniformly documented across all waves. Overall, Shai-Hulud represents a prominent example of a supply-chain worm that combines credential theft, automated republication, and abuse of legitimate developer workflows to spread through trusted software ecosystems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2025-10894 highlights how a single workflow misconfiguration can cascade into widespread compromise across the JavaScript ecosystem. The attack chain for CVE-2025-10894 began with exploitation of a GitHub Actions workflow in the Nx repository. The workflow used the pull_request_target trigger, which grants elevated permissions (including a writable GITHUB_TOKEN) to workflows running on pull requests from forks. Attackers crafted pull requests with titles containing bash injection payloads. | The campaign escalated with the release of a self-replicating worm (Shai-Hulud) that used harvested npm credentials to infect additional packages, resulting in over 500 compromised npm projects.
Shai-Hulud is a self-propagating, info-stealing malware that infects software components, uses the access to publish poisoned versions, and then harvests the repository accounts of those affected by the malware downstream.
359 GitHub repos created with encrypted stolen credentials — “Shai-Hulud: Here We Go Again.” CVE-2026-45321 published CVSS 9.6 critical. Mitre, CISA, and major registry operators issue coordinated advisories. | Shai-Hulud is, at this point, a very familiar name... The most recent one being the so-called Mini Shai-Hulud... they are back again... compromising the TanStack Router packages, and starting a brand new campaign based on Mini Shai-Hulud.
In the Shai-Hulud incident, the compromised packages (MAL-2025-46974 and CVE-2025-59144) were identified early, providing actionable findings that customers could remediate quickly.
8 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Although the malware has some similarities to the Shai-Hulud and Miasma campaigns, and it contains the Miasma string multiple times inside its code, this malware isn't the same as them, nor is it attributed to the Miasma/Shai-Hulud/TeamPCP campaigns that we've seen in the past.
In the Shai-Hulud / Miasma family of supply chain worms, the description stamped onto attacker-created GitHub dead-drop repos has functioned as a campaign signature since the original wave hit in September 2025.
In the Shai-Hulud / Miasma family of supply chain worms, the description stamped onto attacker-created GitHub dead-drop repos has functioned as a campaign signature since the original wave hit in September 2025.
The group often uses a purpose-built, self-replicating npm worm it developed called Shai-Hulud to infect GitHub projects.
researchers say are enabling variants of the Shai-Hulud supply-chain worm to infect and compromise hundreds of software packages and developer accounts worldwide.
A new wave of the Shai-Hulud supply chain campaign, adding 23 newly discovered malicious PyPI package-version artifacts to an already alarming operation that previously compromised 37 packages.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
When a developer installed an infected component, the malware not only stole their secrets, but also used their credentials to hijack other packages they maintained automatically, republishing them in infected form to spread further.
Subsequent investigation confirmed that this was a deliberate supply-chain compromise. The malicious code was introduced by a developer known as “Jia Tan”, who spent two years building trust within the project before planting a sophisticated backdoor.
On Windows, it used cmd.exe to delete the contents of the user's profile directory... On Linux and macOS, it located the user's writable files, overwrote them with the shred command
When a developer installed an infected component, the malware not only stole their secrets, but also used their credentials to hijack other packages they maintained automatically, republishing them in infected form to spread further.
Persistence - скрипт payload_1.sh устанавливает gh-token-monitor: на macOS через launchctl load
Отдельный модуль на Python читает /proc/<PID>/mem процесса Runner.Worker GitHub Actions, вытаскивая JSON-объекты с {"value":"...","isSecret":true}
When a developer installed an infected component, the malware not only stole their secrets, but also used their credentials to hijack other packages they maintained automatically, republishing them in infected form to spread further.
Defense Evasion (T1027, T1140). Payload обфусцирован в несколько слоёв: hex-кодирование строк, XOR-шифрование, AES-256-GCM, вложенные вызовы Function(atob(...)).
Отдельный модуль на Python читает /proc/<PID>/mem процесса Runner.Worker GitHub Actions, вытаскивая JSON-объекты с {"value":"...","isSecret":true}
harvesting more than 500,000 credentials from over 10,000 CI/CD pipelines, including cloud tokens, Kubernetes secrets, and GitHub and GitLab access tokens.
the malware not only stole their secrets... The attack exposed more than 1,500 sensitive secrets, including AWS, Azure, GCP and GitHub tokens
Shai-Hulud harvests GitHub and cloud service credentials from developer machines and CI environments, so compromising one employee was enough to reach Suno's internal systems.
Малварь перебирает файловую систему... конфигурации криптокошельков и AI-инструментов.
Rather than relying exclusively on traditional malware infrastructure, the attackers used GitHub repositories as dead-drop locations for stolen data. In some cases, more than 2,500 public repositories were reportedly created using compromised GitHub tokens for this purpose.
C2 и Exfiltration (T1104, T1041). Украденные данные шифруются и уходят через несколько каналов
213 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a similar campaign/tool for comparison only; the article explicitly says the AsyncAPI malware is not attributed to Shai-Hulud.
A self-replicating supply-chain worm that masquerades as legitimate packages, steals developer secrets, abuses stolen credentials to hijack additional maintained packages, and republishes them in infected form to propagate further across the open-source ecosystem.
Shai-Hulud is a worm that harvests GitHub and cloud service credentials from developer machines and CI environments, exfiltrates them to a public GitHub repository under the victim's own account, and spreads by republishing malicious versions of packages accessible through stolen npm and GitHub accounts. Later waves added destructive behavior that wipes home directories when exfiltration fails, and variants expanded to poison AI toolchains and target npm, PyPI, and Packagist.
Referenced as a prior campaign/malware with similarities to the analyzed payload, but explicitly stated to be distinct from the current malware.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.